File scan report
Verdict Malicious
Is matcha.
The evidence strongly indicates a trojan downloader, with Microsoft naming Doina and Kaspersky naming Magnar.
Strong evidence · Two or more major antivirus engines agree.
If you already ran it, follow the steps below.
What to do now4 steps
This file is harmful. Don't run it, and remove it.
If you haven't run it
Don't run this file. Delete it, then empty the Recycle Bin.
If you already ran it
Disconnect the device from the internet, then run a full antivirus scan. Microsoft Defender Offline (Windows Security > Virus & threat protection > Scan options) also finds malware that hides while Windows runs.
If any of your files were locked or renamed, don't pay the ransom: payment rarely brings files back. Restore them from a backup instead.
If the scan keeps finding it, or the device still acts strangely, scan again with a second-opinion scanner from another company; if that doesn't fix it, back up your personal files and reinstall Windows.
If you already ran it, do these in order.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
44 of 67 flagged
- Flagged 44
- No detection 23
- No result 8
- Code signing Unsigned
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
6 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
A sandbox returned a malware finding and observed temporary executables, Python bootstrap downloads, and five offensive MITRE techniques; do not run the file.
Detection is broad: 44 of the 67 antivirus engines that checked it flagged the executable, including ten major antivirus engines and 37 independent engine votes. Microsoft identifies Doina, while Kaspersky and several other engines identify downloader or Kryptik-style trojan activity, though exact family naming varies. The completed sandbox run produced a malware finding and mapped the activity to T1485, T1486, T1562.001, T1548, and T1055. Runtime records also show temporary executables and curl-based retrieval of Python components, consistent with staged setup. The file is unsigned, has only two recorded submitters, and lacks an established publisher history. The absence of known-bad contacted hosts and external-intelligence matches does not outweigh the major detections and hostile evidence from the test run.
What We Detected
Forty-four of the 67 antivirus engines that checked it flagged matcha.exe, including ten major antivirus engines and 37 independent detection votes. Microsoft identifies Doina, Kaspersky identifies Magnar, and ESET-NOD32 and Fortinet use Kryptik or GenKryptik labels. Family naming is not fully consistent, but the engines broadly agree that the executable is a trojan or downloader.
Threat Behavior
The completed sandbox run returned a malware finding. It recorded the launch of temporary executables, followed by curl commands that downloaded an embedded Python archive and the pip bootstrap script into a Windows profile-like directory. The T1055 mapping indicates possible injection, but no target process was identified.
The host-reputation check covered all 18 distinct observed hosts and found no currently known-malicious or suspicious entries. That counter-signal is limited because ordinary services and trusted infrastructure can still support staged execution. Ten dropped files also have no saved verdict, so they provide no conclusive evidence either way.
What To Do Now
Do not launch the executable. Quarantine or delete it while keeping security software enabled. If it has already run, disconnect the system from the network, perform a full endpoint scan, inspect persistence and recently created files, and change sensitive credentials from a separate trusted device.
Where this verdict could be wrong4 caveats
- The completed host-reputation cross-check found no known-malicious or suspicious hosts among 18 observed contacts, although trusted infrastructure can still be used during payload setup.
- No malware-specific YARAify, MalwareBazaar, or CIRCL hit corroborated the sample.
- The two major antivirus engines naming Doina do not meet the three-engine threshold for strong family consensus.
- Ten dropped files lack saved verdicts, so their safety remains unresolved rather than established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The completed reputation check found no known-malicious or suspicious entries among all 18 observed contacted hosts.
- No malware-specific external research rule or sample-feed match was available.
- No high-entropy code or recognized packer was identified.
- Forty-four of the 67 antivirus engines that checked it flagged the executable, including ten major antivirus engines.
- The sandbox returned a malware finding and recorded five offensive MITRE techniques.
- The sample launched temporary executables and downloaded Python components through command-line tools.
- The executable has no digital signature or established publisher history.
- Only two submitters have been recorded, providing little benign prevalence evidence.
- Engine labels repeatedly describe a trojan, downloader, or obfuscated Kryptik-style payload.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; 1 test environment rated what it did as risky.
Test run summary
Capture complete- 22sandbox rule tags
- 12spawned processes
- 18network contacts
- 31filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
High concern: Encrypted files on the test computer, as ransomware does.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Hid files or windows on the test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How downloaders work
This file is a delivery vehicle. On its own it can look small and harmless, but its job is to fetch and install the real payload, often a password stealer, ransomware or a bot, from a server the attacker controls.
Bottom line:Because the dangerous part arrives later, early scans can look cleaner than the threat really is.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
matcha.exe
1c807dbf94aa75e99f977124e57e43631af47ce1ecc70f791a929742bfcaf5a5
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
matcha.exe
"C:\Users\<USER>\Desktop\matcha.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
matrixhub.exe
"C:\Users\<USER>\AppData\Local\Temp\BE32889A\matrixhub.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
matrixhub.exe
C:\Users\<USER>\AppData\Local\Temp\BE32889A\matrixhub.exe
Test run - Evidence 5 of 7: Written fileSeen in the test run
Launcher.exe
C:\Users\<USER>\AppData\Local\Temp\3552889A\Launcher.exe
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
polygon-rpc.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostWorked out from other results
rpc-mainnet.matic.quiknode.pro
Saved reputation verdict: safe.
Contacted-host cross-check - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 22 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
44 of the 67 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 44
- Avira (major engine)TR/W64.Evo
- BitDefender (major engine)Gen:Variant.Midie.179734
- Emsisoft (major engine)Dump:Generic.Dacic.11262.1853EE80 (B)
- ESET-NOD32 (major engine)Win64/Kryptik.HSU trojan
- F-Secure (major engine)Trojan.TR/W64.Evo
- Fortinet (major engine)W64/GenKryptik.HQGK!tr
- GData (major engine)Dump:Generic.Dacic.11262.1853EE80
- Ikarus (major engine)Trojan.Win64.Krypt
File fingerprint
- Last analyzed
- Oct 10, 2026, 8:02 PM UTC
- SHA-256
1c807dbf94aa75e99f977124e57e43631af47ce1ecc70f791a929742bfcaf5a5- SHA-1
b30986bbfb3a69acfa1b0f91dc1af5b304565656- MD5
2619dcc9f9addb95dcbce365e02ebc09
About this file
matcha.exe is a Win32 EXE file of 777.2 kB.
- Type and size
- Win32 EXE · 777.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Sep 25, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 5.99 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is matcha.exe malware?
What is matcha.exe?
How many antivirus engines detected matcha.exe?
I already downloaded and ran matcha.exe — what should I do?
How do I remove matcha.exe?
What kind of malware is matcha.exe?
What is the SHA-256 hash of matcha.exe?
How up to date is this analysis of matcha.exe?
Community
Member reviews and reports for this exact file hash.